Keep runtime restores out of generic dependency locks #38
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: Build, verify, and release | |
| on: | |
| pull_request: | |
| push: | |
| branches: | |
| - main | |
| concurrency: | |
| group: sift-${{ github.ref }} | |
| cancel-in-progress: false | |
| env: | |
| DOTNET_NOLOGO: true | |
| DOTNET_CLI_TELEMETRY_OPTOUT: true | |
| DOTNET_SKIP_FIRST_TIME_EXPERIENCE: true | |
| jobs: | |
| verify: | |
| name: Verify source and tests | |
| runs-on: windows-latest | |
| permissions: | |
| contents: read | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 | |
| with: | |
| dotnet-version: 10.0.x | |
| cache: true | |
| cache-dependency-path: | | |
| src/Stratus.Sift.Cli/packages.lock.json | |
| src/Stratus.Sift.Core/packages.lock.json | |
| src/Stratus.Sift.Contracts/packages.lock.json | |
| src/Stratus.Sift.FileSystem/packages.lock.json | |
| src/Stratus.Sift.Connectors/packages.lock.json | |
| tests/Stratus.Sift.Cli.Tests/packages.lock.json | |
| - name: Restore locked dependencies | |
| run: dotnet restore Stratus.Sift.slnx --locked-mode | |
| - name: Build | |
| run: dotnet build Stratus.Sift.slnx --configuration Release --no-restore | |
| - name: Test | |
| run: dotnet test Stratus.Sift.slnx --configuration Release --no-build | |
| - name: Verify source boundary | |
| shell: pwsh | |
| run: ./eng/Verify-PublicBoundary.ps1 | |
| build-release: | |
| name: Build ${{ matrix.rid }} | |
| needs: verify | |
| runs-on: ${{ matrix.runner }} | |
| permissions: | |
| contents: read | |
| strategy: | |
| fail-fast: false | |
| matrix: | |
| include: | |
| - rid: win-x64 | |
| runner: windows-latest | |
| executable: sift.exe | |
| - rid: win-arm64 | |
| runner: windows-11-arm | |
| executable: sift-win-arm64.exe | |
| - rid: linux-x64 | |
| runner: ubuntu-24.04 | |
| executable: sift-linux-x64 | |
| - rid: linux-arm64 | |
| runner: ubuntu-24.04-arm | |
| executable: sift-linux-arm64 | |
| - rid: osx-x64 | |
| runner: macos-15-intel | |
| executable: sift-osx-x64 | |
| - rid: osx-arm64 | |
| runner: macos-15 | |
| executable: sift-osx-arm64 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Setup .NET | |
| uses: actions/setup-dotnet@26b0ec14cb23fa6904739307f278c14f94c95bf1 # v5 | |
| with: | |
| dotnet-version: 10.0.x | |
| cache: true | |
| cache-dependency-path: | | |
| eng/locks/packages.${{ matrix.rid }}.lock.json | |
| src/Stratus.Sift.Core/packages.lock.json | |
| src/Stratus.Sift.Contracts/packages.lock.json | |
| src/Stratus.Sift.FileSystem/packages.lock.json | |
| src/Stratus.Sift.Connectors/packages.lock.json | |
| - name: Set release version | |
| id: version | |
| shell: pwsh | |
| run: '"version=0.1.${{ github.run_number }}" | Out-File -FilePath $env:GITHUB_OUTPUT -Append' | |
| - name: Build Native AOT release | |
| shell: pwsh | |
| run: ./eng/Build-Release.ps1 -Version '${{ steps.version.outputs.version }}' -RuntimeIdentifier '${{ matrix.rid }}' | |
| - name: Smoke test native executable | |
| shell: pwsh | |
| run: | | |
| $executable = Resolve-Path './artifacts/release/${{ matrix.rid }}/${{ matrix.executable }}' | |
| if (-not $IsWindows) { | |
| chmod 755 $executable | |
| } | |
| $version = (& $executable --version).Trim() | |
| if ($LASTEXITCODE -ne 0 -or -not $version.StartsWith('${{ steps.version.outputs.version }}')) { | |
| throw "Unexpected version: $version" | |
| } | |
| $smokeOutput = Join-Path $env:RUNNER_TEMP 'sift-smoke.json' | |
| & $executable local --path . --enum-only --output $smokeOutput --output-format json | |
| $json = Get-Content -LiteralPath $smokeOutput -Raw | ConvertFrom-Json | |
| if ($LASTEXITCODE -ne 0 -or $json.SchemaVersion -ne '1.0' -or $json.Errors -ne 0) { | |
| throw 'The native scan smoke test failed.' | |
| } | |
| - name: Verify executable boundary | |
| shell: pwsh | |
| run: ./eng/Verify-PublicBoundary.ps1 -ArtifactPath './artifacts/release/${{ matrix.rid }}/${{ matrix.executable }}' | |
| - name: Upload release assets | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: release-${{ matrix.rid }} | |
| path: artifacts/release/${{ matrix.rid }}/* | |
| if-no-files-found: error | |
| retention-days: 7 | |
| release: | |
| name: Publish release | |
| if: github.event_name == 'push' && github.ref == 'refs/heads/main' | |
| needs: | |
| - verify | |
| - build-release | |
| runs-on: ubuntu-24.04 | |
| permissions: | |
| contents: write | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09 # v5 | |
| with: | |
| fetch-depth: 0 | |
| persist-credentials: false | |
| - name: Set release version | |
| id: version | |
| shell: pwsh | |
| run: '"version=0.1.${{ github.run_number }}" | Out-File -FilePath $env:GITHUB_OUTPUT -Append' | |
| - name: Download release assets | |
| uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1 | |
| with: | |
| pattern: release-* | |
| path: artifacts/release | |
| merge-multiple: true | |
| - name: Verify assets and write checksums | |
| shell: pwsh | |
| run: | | |
| $releaseRoot = Resolve-Path 'artifacts/release' | |
| $partialChecksums = @(Get-ChildItem $releaseRoot -File -Filter 'SHA256SUMS-*.txt') | |
| if ($partialChecksums.Count -ne 6) { | |
| throw "Expected six platform checksum files, found $($partialChecksums.Count)." | |
| } | |
| foreach ($checksumFile in $partialChecksums) { | |
| $lines = [System.IO.File]::ReadAllLines($checksumFile.FullName) | |
| if ($lines.Count -ne 1) { | |
| throw "Expected one binary checksum in $($checksumFile.Name), found $($lines.Count)." | |
| } | |
| foreach ($line in $lines) { | |
| if ($line -notmatch '^([0-9a-f]{64}) (.+)$') { | |
| throw "Invalid checksum line in $($checksumFile.Name): $line" | |
| } | |
| $asset = Join-Path $releaseRoot $Matches[2] | |
| $actual = (Get-FileHash -LiteralPath $asset -Algorithm SHA256).Hash.ToLowerInvariant() | |
| if ($actual -ne $Matches[1]) { | |
| throw "Checksum mismatch for $($Matches[2])." | |
| } | |
| } | |
| } | |
| $assets = @(Get-ChildItem $releaseRoot -File | Where-Object Name -NotLike 'SHA256SUMS-*.txt' | Sort-Object Name) | |
| if ($assets.Count -ne 6) { | |
| throw "Expected six release binaries, found $($assets.Count)." | |
| } | |
| $checksums = foreach ($asset in $assets) { | |
| $hash = (Get-FileHash -LiteralPath $asset.FullName -Algorithm SHA256).Hash.ToLowerInvariant() | |
| "$hash $($asset.Name)" | |
| } | |
| [System.IO.File]::WriteAllLines( | |
| (Join-Path $releaseRoot 'SHA256SUMS.txt'), | |
| $checksums, | |
| [System.Text.UTF8Encoding]::new($false)) | |
| Remove-Item $partialChecksums.FullName -Force | |
| - name: Create GitHub release | |
| shell: pwsh | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| RELEASE_VERSION: ${{ steps.version.outputs.version }} | |
| run: | | |
| $tag = "v$env:RELEASE_VERSION" | |
| $assets = @(Get-ChildItem 'artifacts/release' -File | Sort-Object Name | ForEach-Object FullName) | |
| if (gh release view $tag 2>$null) { | |
| gh release upload $tag @assets --clobber | |
| } | |
| else { | |
| gh release create $tag @assets --target $env:GITHUB_SHA --generate-notes --title "Stratus Sift $env:RELEASE_VERSION" | |
| } |